### Impact
For Mautic versions prior to 3.3.4, there is an XSS vulnerability on Mautic's password reset page where a vulnerable parameter, "bundle," in the URL could allow an attacker to execute Javascript code. The attacker would be required to convince or trick the target into clicking a password reset URL with the vulnerable parameter utilized.

### Patches

Upgrade to 3.3.4 or 4.0.0

### Workarounds

### References

https://github.com/mautic/mautic/releases/tag/3.3.4
https://github.com/mautic/mautic/releases/tag/4.0.0

### For more information
If you have any questions or comments about this advisory:
* Email us at [[email protected]](mailto:[email protected])

Affected Packages

Packagist mautic/core

Affected versions: 0 (fixed in 3.3.4)

Packagist mautic/core

Affected versions: 4.0.0-alpha1 (fixed in 4.0.0)

Related CVEs

CVE-2021-27909

Key Information

GHSA ID

GHSA-32hw-3pvh-vcvc

Published

September 1, 2021 6:40 PM

Last Modified

August 30, 2021 6:03 PM

CVSS Score

5.0 /10

Primary Ecosystem

Packagist

Primary Package

mautic/core

GitHub Reviewed

✓ Yes

Dataset

Last updated: June 18, 2025 6:25 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.